Anonymous takes down Department of Justice and Universal Music

Re:Anonymous takes down Department of Justice and Universal ... by jiggy2011 on Friday January 20, 2012 @07:14AM (#3489213)

Which hash functions built into the web server would they attack?

I can't think of a specific time in a normal HTTP request that would use a user-supplied hash.

I would assume only a minority of pages on the average site would eat CPU so surely the sensible defense to this would be to impose a maximum CPU usage on these parts so the rest of the website continues to work.

[ Parent | on HN ]

Re:Anonymous takes down Department of Justice and Universal ... by pilate on Friday January 20, 2012 @11:05AM (#3489903)

Any PHP page will propagate the $_POST and $_GET arrays from user supplied data.

[ Parent | on HN ]

Re:Anonymous takes down Department of Justice and Universal ... by jiggy2011 on Friday January 20, 2012 @12:09PM (#3490172)

good point, so the idea would be to supply something like:

page.php?x=1&y=1...

where the x and y keys are going to have the same hash value, so that when it uses those vars in a page it will hit the same hash bucket and become O(n) not O(1)?

Of course you would want to send a lot of different vars in.

[ Parent | on HN ]

Re:Anonymous takes down Department of Justice and Universal ... by getsat on Friday January 20, 2012 @12:16PM (#3490212)

Yup, though I'd probably pass those in using a POST request. A 5,000,000 character long log entry sticks out a bit, and most people aren't logging POST params by default.

[ Parent | on HN ]